Xen Advisories Disclose Linux Guest Kernel Flaws Enabling Privilege Escalation

Xen has disclosed two Linux guest kernel vulnerabilities affecting virtualized environments, warning that both issues require patching and have no known mitigations. CVE-2026-31786 (XSA-485) affects Linux kernels 4.13 and later in Xen domains through unsafe handling of the binary build ID exposed at /sys/hypervisor/properties/buildid. The bug uses sprintf() on a non-null-terminated binary value, which can trigger an out-of-bounds read and, in rare cases, a write past the 4 KB sysfs buffer, potentially leading to information disclosure, denial of service, or privilege escalation inside Linux Xen guests.

A second advisory, CVE-2026-31787 (XSA-487), describes a double-free flaw in the Linux Xen privcmd driver that allows a root user in a Linux guest to bypass kernel lockdown protections tied to secure boot. Xen said the issue affects Linux PVH or HVM domains on x86 and Arm from kernel 3.8 onward, while PV domains and non-Linux guests are not affected. The vulnerabilities were reported by Frediano Ziglio of XenServer and Atharva Vartak (@0xAth4rv), respectively, and Xen urged operators to apply the supplied Linux patches.